Hello, welcome to the Monday, April 11, 2000, 22 edition of the Sandtonet Storm Center's Stormcast. My name is Johannes Ulrich,

and I'm recording from Jacksonville, Florida. Well, let's start with a couple of Spring for Shell

related items that sort of came out last week, but didn't make it in any of last

week's podcast. So really just a little bit follow-up here. First of all, Cisco keeps updating

its advisory. They labeled this vulnerability as critical, and there is no a long list of Cisco products that are affected for which

also at least in some cases updates are available so if you are a Cisco customer double

check this advisory i'll link to it in the show notes had actually a little bit of hard time myself finding the correct advisory here that lists all the vulnerable products.

And I do believe this is still very much work in progress, so keep checking it for any updates, any new products included here.

And Trent Micro is reporting that they're seeing some exploitation of the vulnerability in order to install the Mirai Botnet.

No real surprise here, Mirai Botnet and CryptoCoinminers is certainly very much expected.

We have seen a number of attempts like that.

Now, the trend micrologs that they are showing really just show that someone is exploiting

the web shell that's being left behind by the proof of concept exploit.

It even still uses the default password.

So this may not so much be an exploitation of actually the Springfarshall war on ability,

but instead it's really more parasitic where they're looking for web shells that are already

installed here in particular particular since they're using

the default password instead of coming up with their own password. This would be a trivial change

to the original exploit. And then more speculative but possibly related to Springforshell is an

announcement by a Twitter user who goes under

Brayson Eagle who claims that there is a seraday vulnerability in EngineX that has not been

patched yet. Now Bracin Eagle has since marked their Twitter account as private.

...